Vulnerability-Lookup

CVE-2025-24816 (GCVE-0-2025-24816)

Vulnerability from cvelistv5 – Published: 2026-06-30 08:58 – Updated: 2026-06-30 13:30

Title

An Improper Access Control vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:30 UTC

CWE

CWE-284 - Improper Access Control

Assigner

Nokia mitre root Scorecard

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: <25R2-NM Unaffected: ≥25R2-NM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:30:08.532062Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:30:45.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c25R2-NM"
            },
            {
              "status": "unaffected",
              "version": "\u226525R2-NM"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T11:40:27.463Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24816/"
        }
      ],
      "title": "An Improper Access Control vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24816",
    "datePublished": "2026-06-30T08:58:29.484Z",
    "dateReserved": "2025-01-24T13:25:43.869Z",
    "dateUpdated": "2026-06-30T13:30:45.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-24816",
      "date": "2026-10-01",
      "epss": "0.0034",
      "percentile": "0.25111"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "MantaRay NM",
                "vendor": "Nokia",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c25R2-NM"
                  },
                  {
                    "status": "unaffected",
                    "version": "\u226525R2-NM"
                  }
                ]
              }
            ],
            "source": "b48c3b8f-639e-4c16-8725-497bc411dad0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:nokia:mantaray_nm:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8B6443BC-E253-42E1-83CD-E681CBE3F6BE",
                    "versionEndExcluding": "25R2-NM",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges."
          },
          {
            "lang": "es",
            "value": "Nokia MantaRay est\u00e1 sujeto a una vulnerabilidad de control de acceso inadecuado debido a una autorizaci\u00f3n insuficiente dentro de la API. La explotaci\u00f3n exitosa podr\u00eda permitir a un atacante autenticado recuperar informaci\u00f3n confidencial m\u00e1s all\u00e1 de sus privilegios asignados."
          }
        ],
        "id": "CVE-2025-24816",
        "lastModified": "2026-09-29T19:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-24816",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:30:08.532062Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-30T10:16:33.617",
        "references": [
          {
            "source": "b48c3b8f-639e-4c16-8725-497bc411dad0",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24816/"
          }
        ],
        "sourceIdentifier": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-284"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 6.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-24816",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-30T13:30:08.532062Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-284",
                    "description": "CWE-284 Improper Access Control",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-30T13:30:40.558Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "MantaRay NM",
              "vendor": "Nokia",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c25R2-NM"
                },
                {
                  "status": "unaffected",
                  "version": "\u226525R2-NM"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-30T11:40:27.463Z",
            "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
            "shortName": "Nokia"
          },
          "references": [
            {
              "name": "Nokia Product Security Advisory",
              "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24816/"
            }
          ],
          "title": "An Improper Access Control vulnerability in Nokia MantaRay NM",
          "x_generator": {
            "engine": "cveClient/1.0.15"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "assignerShortName": "Nokia",
        "cveId": "CVE-2025-24816",
        "datePublished": "2026-06-30T08:58:29.484Z",
        "dateReserved": "2025-01-24T13:25:43.869Z",
        "dateUpdated": "2026-06-30T13:30:45.148Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-331371

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:50

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:50:15.749823+00:00",
  "id": "EUVD-2026-331371"
}

FKIE_CVE-2025-24816

Vulnerability from fkie_nvd - Published: 2026-06-30 10:16 - Updated: 2026-09-29 19:10

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	b48c3b8f-639e-4c16-8725-497bc411dad0	https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24816/	Vendor Advisory

Impacted products

	Vendor	Product	Version
	nokia	mantaray_nm	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c25R2-NM"
            },
            {
              "status": "unaffected",
              "version": "\u226525R2-NM"
            }
          ]
        }
      ],
      "source": "b48c3b8f-639e-4c16-8725-497bc411dad0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nokia:mantaray_nm:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B6443BC-E253-42E1-83CD-E681CBE3F6BE",
              "versionEndExcluding": "25R2-NM",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges."
    },
    {
      "lang": "es",
      "value": "Nokia MantaRay est\u00e1 sujeto a una vulnerabilidad de control de acceso inadecuado debido a una autorizaci\u00f3n insuficiente dentro de la API. La explotaci\u00f3n exitosa podr\u00eda permitir a un atacante autenticado recuperar informaci\u00f3n confidencial m\u00e1s all\u00e1 de sus privilegios asignados."
    }
  ],
  "id": "CVE-2025-24816",
  "lastModified": "2026-09-29T19:10:00.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24816",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-30T13:30:08.532062Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-30T10:16:33.617",
  "references": [
    {
      "source": "b48c3b8f-639e-4c16-8725-497bc411dad0",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24816/"
    }
  ],
  "sourceIdentifier": "b48c3b8f-639e-4c16-8725-497bc411dad0",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-RR5R-RHQX-65GR

Vulnerability from github – Published: 2026-06-30 12:31 – Updated: 2026-06-30 15:30

Details

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-24816"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T10:16:33Z",
    "severity": "MODERATE"
  },
  "details": "Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges.",
  "id": "GHSA-rr5r-rhqx-65gr",
  "modified": "2026-06-30T15:30:44Z",
  "published": "2026-06-30T12:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24816"
    },
    {
      "type": "WEB",
      "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24816"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-24816 (GCVE-0-2025-24816)

EUVD-2026-331371

FKIE_CVE-2025-24816

GHSA-RR5R-RHQX-65GR

Tags

Sightings

Nomenclature

Related by attack behaviour